Facebook always required the initial user to give permissions including access to friends. But for many years once that was granted all public/friend shared fri

Facebook always required the initial user to give permissions including access to friends. But for many years once that was granted all public/friend shared friend data was available that others shared with their friends by design. They closed that off with OpenGraph v2 where they even changed friend ids/invites to be unique to the app so that data was not able to be correlated easily across apps. They did it for privacy but mainly because other groups were pulling in the social graph and maybe it became a competitive threat. People that weren't developers or in marketing probably had the expectation Facebook was a private walled garden where they were only sharing with their friends but once one friend gave those permissions, many bad apps started to see how they could pull down the entire social graph. This has since changed with OpenGraph v2 in 2013-14 but it was exploited by nefarious groups for a time. I think most of the permissions model was fine before the bad apps and shady groups that are using your data for targeting purposes beyond games, apps and ads. Once it started to be used for aims beyond harmless fun like games that is where people got angry especially in targeted politics.